From d9819ec090bb533b79a257daa3461045c2422c05 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Thu, 26 Feb 2004 11:29:56 +0000 Subject: Implement 'net groupmap set' and 'net groupmap cleanup'. I was rather annoyed by the net groupmap syntax, I could never get it right. net groupmap set "domain admins" domadm creates a mapping, net groupmap set "domain admins" -C "Comment" -N "newntname" should also do what you expect. I'd like to have some feedback on the usability of this. net groupmap cleanup solves a problem I've had two times now: Our SID changed, and a user's primary group was mapped to a SID that is not ours. net groupmap cleanup removes all mappings that are not from our domain sid. Volker (This used to be commit eb4d4faff8c14e999f414ca5b6e8c25a558859c8) --- source3/utils/net.c | 11 ++++ source3/utils/net.h | 5 ++ source3/utils/net_groupmap.c | 141 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 157 insertions(+) diff --git a/source3/utils/net.c b/source3/utils/net.c index 01f56b8a0c..8004ced43e 100644 --- a/source3/utils/net.c +++ b/source3/utils/net.c @@ -73,6 +73,10 @@ int opt_flags = -1; int opt_timeout = 0; const char *opt_target_workgroup = NULL; int opt_machine_pass = 0; +BOOL opt_localgroup = False; +BOOL opt_domaingroup = False; +const char *opt_newntname = ""; +int opt_rid = 0; BOOL opt_have_ip = False; struct in_addr opt_dest_ip; @@ -680,6 +684,13 @@ static struct functable net_func[] = { {"timeout", 't', POPT_ARG_INT, &opt_timeout}, {"machine-pass",'P', POPT_ARG_NONE, &opt_machine_pass}, {"myworkgroup", 'W', POPT_ARG_STRING, &opt_workgroup}, + + /* Options for 'net groupmap set' */ + {"local", 'L', POPT_ARG_NONE, &opt_localgroup}, + {"domain", 'D', POPT_ARG_NONE, &opt_domaingroup}, + {"ntname", 'N', POPT_ARG_STRING, &opt_newntname}, + {"rid", 'R', POPT_ARG_INT, &opt_rid}, + POPT_COMMON_SAMBA { 0, 0, 0, 0} }; diff --git a/source3/utils/net.h b/source3/utils/net.h index 94e6de9d18..62d5a74237 100644 --- a/source3/utils/net.h +++ b/source3/utils/net.h @@ -57,6 +57,11 @@ extern const char *opt_user_name; extern const char *opt_password; extern BOOL opt_user_specified; +extern BOOL opt_localgroup; +extern BOOL opt_domaingroup; +extern const char *opt_newntname; +extern int opt_rid; + extern BOOL opt_have_ip; extern struct in_addr opt_dest_ip; diff --git a/source3/utils/net_groupmap.c b/source3/utils/net_groupmap.c index 416f42507d..2b487ef17b 100644 --- a/source3/utils/net_groupmap.c +++ b/source3/utils/net_groupmap.c @@ -473,6 +473,141 @@ static int net_groupmap_delete(int argc, const char **argv) return 0; } +static int net_groupmap_set(int argc, const char **argv) +{ + const char *ntgroup = NULL; + struct group *grp = NULL; + GROUP_MAP map; + BOOL have_map = False; + + if ((argc < 1) || (argc > 2)) { + d_printf("Usage: net groupmap set \"NT Group\" " + "[\"unix group\"] [-C \"comment\"] [-L] [-D]\n"); + return -1; + } + + if ( opt_localgroup && opt_domaingroup ) { + d_printf("Can only specify -L or -D, not both\n"); + return -1; + } + + ntgroup = argv[0]; + + if (argc == 2) { + grp = getgrnam(argv[1]); + + if (grp == NULL) { + d_printf("Could not find unix group %s\n", argv[1]); + return -1; + } + } + + have_map = pdb_getgrnam(&map, ntgroup); + + if (!have_map) { + DOM_SID sid; + have_map = ( (strncmp(ntgroup, "S-", 2) == 0) && + string_to_sid(&sid, ntgroup) && + pdb_getgrsid(&map, sid) ); + } + + if (!have_map) { + + /* Ok, add it */ + + if (grp == NULL) { + d_printf("Could not find group mapping for %s\n", + ntgroup); + return -1; + } + + map.gid = grp->gr_gid; + + if (opt_rid == 0) { + opt_rid = pdb_gid_to_group_rid(map.gid); + } + + sid_copy(&map.sid, get_global_sam_sid()); + sid_append_rid(&map.sid, opt_rid); + + map.sid_name_use = SID_NAME_DOM_GRP; + fstrcpy(map.nt_name, ntgroup); + fstrcpy(map.comment, ""); + + if (!pdb_add_group_mapping_entry(&map)) { + d_printf("Could not add mapping entry for %s\n", + ntgroup); + return -1; + } + } + + /* Now we have a mapping entry, update that stuff */ + + if ( opt_localgroup || opt_domaingroup ) { + if (map.sid_name_use == SID_NAME_WKN_GRP) { + d_printf("Can't change type of the BUILTIN group %s\n", + map.nt_name); + return -1; + } + } + + if (opt_localgroup) + map.sid_name_use = SID_NAME_ALIAS; + + if (opt_domaingroup) + map.sid_name_use = SID_NAME_DOM_GRP; + + /* The case (opt_domaingroup && opt_localgroup) was tested for above */ + + if (strlen(opt_comment) > 0) + fstrcpy(map.comment, opt_comment); + + if (strlen(opt_newntname) > 0) + fstrcpy(map.nt_name, opt_newntname); + + if (grp != NULL) + map.gid = grp->gr_gid; + + if (!pdb_update_group_mapping_entry(&map)) { + d_printf("Could not update group mapping for %s\n", ntgroup); + return -1; + } + + return 0; +} + +static int net_groupmap_cleanup(int argc, const char **argv) +{ + GROUP_MAP *map = NULL; + int i, entries; + + if (!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, + ENUM_ALL_MAPPED)) { + d_printf("Could not list group mappings\n"); + return -1; + } + + for (i=0; i